Privacy Policy

This policy explains how Duzenio (“Duzenio”, “we”, “us”) collects, uses and shares personal data when you use the Duzenio website at duzenio.com, the web application at app.duzenio.com, and the Duzenio desktop and mobile apps (together, the “Service”).

It applies to three kinds of people:

• Visitors — anyone browsing this website.
• Workspace owners and administrators — the person or organisation that created a Duzenio workspace and invites others into it (the “Customer”).
• Members — employees, contractors and clients who use Duzenio because a Customer invited them.

If you are a Member, the Customer that invited you decides what Duzenio tracks in your workspace and is responsible for telling you about it. Section 9 explains what that means for your rights.

Account data. Your name, email address, password (stored only as a salted hash), profile picture if you add one, job title, time zone, and the workspace you belong to.

Workspace content. Everything you and your team put into Duzenio: projects, boards, tickets and their history, comments, chat messages, documents, timesheets, leave requests, invoices and client records. This often contains personal data about people other than you, for example a client’s contact details.

Time and activity data. When you clock in, when you clock out, the project or ticket the time is booked against, and periods of idle time detected by the app.

Screenshots and activity levels — desktop app only, and only while the timer is running. See section 3.

Technical data. IP address, browser or app version, operating system, device identifiers the platform provides, crash reports, and logs of requests to our servers. We use these to keep the Service running and secure.

Billing data. If you pay for Duzenio, your billing contact, company details and invoice history. Card numbers are handled by our payment processor and never reach our servers.

Support correspondence. Emails you send to us and our replies.

The desktop app exists to track time without you having to keep a browser tab open. While the timer is running it can capture:

• Screenshots of your screen at intervals set by your workspace administrator. The app may blur screenshots or capture only the active window depending on the workspace settings.
• Activity levels — a count of keyboard and mouse events per interval. The app records that keys were pressed and the mouse moved, not which keys or what you typed. It is not a keylogger.
• Idle detection — periods with no input, so idle time can be deducted from timesheets.

The app captures nothing when the timer is stopped, and it shows a visible indicator while tracking. You can stop the timer at any time, and you can delete a screenshot from your own timeline before your workspace’s review window closes, unless your administrator has disabled that.

Screenshots are uploaded over an encrypted connection and stored in your workspace, where they are visible to you and to the people your administrator has given permission to view them. Duzenio staff do not look at screenshots except to diagnose a fault you have reported, and then only the minimum needed.

The desktop app also fetches a small configuration file from this website on every launch to learn where the application lives. That request carries no personal data beyond your IP address and app version.

We use personal data to:

• Provide the Service: run your workspace, sync it between devices, and generate timesheets, reports and invoices from it.
• Keep it secure: detect abuse, prevent unauthorised access, and investigate incidents.
• Support you: answer questions and diagnose problems.
• Bill you and comply with tax and accounting obligations.
• Improve the Service, using aggregated usage statistics that do not identify individuals.
• Tell you about material changes to the Service, these terms or this policy.

We do not sell personal data. We do not use workspace content, screenshots or activity data to train machine-learning models, to build advertising profiles, or for any purpose other than delivering the Service to the workspace that produced it.

Legal bases. Where data-protection law requires one, we rely on: performance of a contract (providing the Service you or your organisation signed up for); our legitimate interests (security, fraud prevention, improving the Service), balanced against your rights; legal obligation (tax and accounting records); and consent, where we ask for it and you can withdraw it.

Duzenio is a team tool, so most of what you put into it is visible to other people in your workspace by design. Your administrator controls the details, but as a rule:

• Workspace owners and administrators can see all workspace content, including everyone’s timesheets, screenshots and activity levels.
• Managers can see the same for the people and projects they are assigned to.
• Members can see their own time and screenshots, and the projects, boards and chats they have been given access to.
• Clients using a client portal see only what the workspace chooses to publish to them: usually project progress, selected documents and invoices. They cannot see screenshots or activity levels.

If you are unsure what your organisation can see, ask your administrator. We cannot change your workspace’s permissions on your behalf.

We share personal data only with providers that help us run the Service, and only what they need for that job. They are bound by contract to process it on our instructions and to protect it. Our current categories of provider are:

• Cloud hosting, storage and content delivery for the application, its database, uploaded files and screenshots.
• Transactional email delivery (invitations, password resets, notifications).
• Payment processing for paid plans.
• Error monitoring and application logging.

We will also disclose personal data if the law requires it, to respond to a valid legal request, to protect the rights, property or safety of Duzenio, our users or the public, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to the transferred data until it is replaced.

A current list of our providers is available on request from info@duzenio.com.

Our providers operate data centres in several countries, so your data may be stored or processed outside the country you live in, including in countries whose data-protection laws differ from yours. Where a transfer needs a legal safeguard, we use recognised mechanisms such as standard contractual clauses, and we ask our providers to do the same.

• Workspace content, time data and screenshots are kept for as long as the workspace exists, subject to any shorter retention period the administrator sets for screenshots. When a workspace is deleted, its content is removed from our live systems within 30 days and from backups within 90 days.
• Account data is kept while your account is active and for 30 days after you delete it, so an accidental deletion can be reversed.
• Billing records are kept for as long as tax and accounting law requires, typically seven years.
• Server logs and technical data are kept for up to 90 days unless needed longer for a security investigation.
• Support correspondence is kept for up to two years.

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to how it is processed, to receive a copy in a portable format, and to withdraw consent you have given. You also have the right to complain to your local data-protection authority.

If you are a Member of a Customer’s workspace, the Customer is the controller of the workspace content, time data and screenshots about you, and we process them on its behalf. Requests about that data should go to your workspace administrator first; they have the tools to act on them. If you contact us instead, we will pass the request to them and help them respond.

For everything else — your account data, billing data, or if you are a Visitor — write to info@duzenio.com. We will respond within 30 days, and we may ask you to verify your identity first.

You can also change your name, email, password and profile picture, and delete your account, from your account settings in the app.

This website sets no cookies and runs no analytics. The application uses a small number of strictly necessary cookies and local storage entries to keep you signed in, remember your preferences and protect against cross-site request forgery. These cannot be switched off without breaking sign-in. We do not use advertising or tracking cookies.

Data travels between your device and our servers over TLS and is encrypted at rest by our hosting providers. Access to production systems is restricted to staff who need it, protected by multi-factor authentication and logged. Passwords are stored as salted hashes and never in a form we can read.

No system is perfectly secure. If we learn of a breach affecting your personal data, we will notify the affected Customer, and where the law requires it, you and the relevant authority, without undue delay.

Duzenio is a workplace tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We will update this policy when the Service or the law changes. The effective date at the top tells you when it last changed. For material changes we will notify workspace owners by email or a notice in the app at least 14 days before they take effect. Continuing to use the Service after that date means you accept the updated policy.